Last updated 9 August 2026 · Rihla is in open alpha.
The short version. Rihla works with no account and no network. If you never sign in, nothing about you ever reaches us — there is no analytics, no advertising, no tracking of any kind, on any platform. If you do sign in for backup, we hold your email address and a blob of encrypted bytes we cannot read.
Everything — your travelers, tasks, habits, Quran progress, bookmarks — lives in storage on your own device. We do not receive it, and there is no copy of it anywhere else. That also means it is yours to lose: clearing your browser data or uninstalling the app removes it permanently. Use More → Backup to keep a copy.
Signing in is optional and free. When you do, we store:
Saves are encrypted on your device with AES-GCM-256, using a key derived from a recovery code that only you hold. What reaches our server is an opaque envelope. We are not being trusted not to look — we are unable to.
The consequence is real and worth stating plainly: if you lose your recovery code, we cannot recover your cloud backup. Nobody can. Your local saves are unaffected, and you can set a new code and upload again.
If something goes wrong, Rihla writes the error to a local log you can read under More → Diagnostics. It is never uploaded. If you want to help us fix a bug you can copy it and send it to us yourself — that is a deliberate choice, and it is the only way any diagnostic reaches us.
Downloadable hadith collections are fetched from our own content registry. That request tells us a collection was downloaded; it is not tied to an account.
Sign-in codes: ten minutes. Sessions: ninety days, or until you sign out. Saves and your email: until you delete them, or until you delete your account.
In the app: More → Rihla Account → Delete account. This removes your email, your sessions and every cloud save immediately and irreversibly. Your local saves stay on your device and are yours to keep or clear.
You can also do it directly: DELETE /account with your session
token. Or write to us and we will do it for you.
Rihla is built for families, and a parent creating a card for a child is the normal case. A child's traveler is data on the parent's device — creating one requires no account, no email, and sends nothing to us. Only the adult who signs in provides an email address. There are no leaderboards, no messaging, no social features and no way for one traveler to see another.
You can ask for a copy of what we hold, correct it, or have it erased. The in-app delete does the last of these instantly. For anything else, write to us. If you are in the UK or EU you may also complain to your data protection authority.
If this policy changes in a way that affects you, we will say so on this page and in the app rather than quietly editing it.
Rihla is made by Seraf. Reach us at hello@rihla.seraf.dev.